| शीर्षक | Node.js oclif 4.23.16 OS Command Injection |
|---|
| विवरण | oclif manifest reads oclif.jitPlugins from a target project's package.json. When JIT plugins are enabled, each plugin name and version is interpolated into an npm pack shell command:
npm pack ${plugin}@${version} --pack-destination "${tarballStoragePath}" --json
That command string is then executed with child_process.exec().
Because the jitPlugins key and value are not shell-escaped or validated before interpolation, shell metacharacters in a plugin name can execute arbitrary commands when oclif manifest is run against a crafted project.
This is reachable through the public CLI:
oclif manifest /path/to/project |
|---|
| स्रोत | ⚠️ https://github.com/oclif/oclif/issues/2051 |
|---|
| उपयोगकर्ता | wjm2 (UID 99050) |
|---|
| सबमिशन | 16/06/2026 05:19 PM (1 महीना पहले) |
|---|
| संयम | 22/07/2026 05:53 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 382372 [oclif तक 4.23.16 JIT Plugin Entry child_process.exec jitPlugins अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|